Instagram "Likes" Worth More Than Stolen Credit Cards

Barence writes "In the world of online fraud, a fake fan on Instagram can be worth five times more than a stolen credit card number. In a sign of the growing value of social network 'likes', the Zeus virus has been modified to create bogus Instagram 'likes' that can be used to generate buzz for a company or individual, according to cyber experts at RSA, the security division of EMC. These fake 'likes' are sold in batches of 1,000 on hacker forums, where cybercriminals also flog credit card numbers and other information stolen from PCs. According to RSA, 1,000 Instagram 'followers' can be bought for $15 and 1,000 Instagram 'likes' go for $30, whereas 1,000 credit card numbers cost as little as $6."

Comments

Do the CCs work?

[MozeeToby]

If they're up for sale on a hacker forum how long are those CC's really going to be valid for? Seems more like you're paying $5 for the chance to race against everyone else to exploit them before they get closed down, which will take somewhere between minutes and hours, certainly not days. Social network followers and likes are much, much more likely to be valid. Still surprising that they go for more than $.01 a piece though, I would have thought less than 1/10th that.

Re:Do the CCs work?

[Yebyen]

A friend's debit card number was stolen. We narrowed down the time when it could have happened to one of two places. Both places were some time during the day Friday. The charges happened Saturday (they bought liquor, $80 of McDonalds, gas, some more drinks at a bar, probably 4-7 people packed into a car spent $600 in one night.)

She found the charges Sunday, cancelled the card within 1 hour.

Worth $5 to someone? Definitely.

Re:Do the CCs work?

[notanalien_justgreen]

How do you buy from an actual store without the physical credit card? I can understand online purchases, but don't you need the piece of plastic to buy at McDonalds? Or do you mean her actual card was stolen (in which case hackers wouldn't be selling it for $5)?

Re:Do the CCs work?

[Firethorn]

That particular CC? Sure. But like others have stated, when the cards are being sold in lots of 1k, odds are most of them are either already invalid or going to be so very quickly. So you might end up trolling through several hundred of them to find a good one, even if there is one.

Your friend's card was likely stolen by other means and not distributed precisely to give it the long longevity. On, and you're probably looking at 2-3 people for that $600.

Then balance the risk vs reward - the reward might be higher with the stolen CC, but so isn't the risk of criminal charges.

Re:Do the CCs work?

[stewsters]

I assume you would make one from the stolen numbers. Most casheers do not scrutinize the card heavily if its signed. http://www.alibaba.com/showroom/credit-card-blanks.html

Re:Do the CCs work?

[plover]

You can erase and re-encode a different account number on an old mag stripe card. You may have noticed some stores have the cashier manually enter the last four digits of the credit card to prevent against this kind of fraud.

For a swipe-it-yourself terminal where the cashier doesn't see or handle the card, the bad guys can use any old card with a mag stripe. Some thieves have been known to reuse old gift cards. At least one scammer glued old VCR tape to cardboard squares and hand-wrote the PIN on the face of the cardboard as he encoded them. He then stood in front of an ATM with a stack of disposable cards, feeding them in one after another to rapidly tap as many accounts as he could.

Oh, and the entire article is wrong by three orders of magnitude. ONE credit card account number can go for between $2.00 - $40.00, based on the type of account and quality of numbers (the percent that will work.) ONE THOUSAND Instagram followers goes for $15.00. That's $0.015 for each fake follower. That's comparable to the going rate for bogus Twitter accounts ($0.02 - $0.10 each), Yahoo email accounts ($0.01 each), or Hotmail accounts ($0.012 each.) Gmail accounts are harder to dynamically create, perceived as spam-resistant, and therefore more valuable to bad guys, and go for $0.20 each.

Re:Do the CCs work?

[Anonymous Coward]

Thanks to US for not pushing chip n pin, It's fairly easy to clone a card, including, sniffing the pin.

But then there'd be things we'd have to updaaaaaaate! And that'd be chaaaaaaange! That's haaaaaaaaaard! Change means we can't maintain our razor-thin margins! And we wouldn't have to hire nearly as many outsourced fraud response operators from India! That's job destroying! We don't wannaaaaaa!

Re:Do the CCs work?

[Yebyen]

We are guessing that someone took a picture of the front of the card with an Iphone.
Nobody has been arrested. We really don't know the answer... the card left her possession only for a minute when the cashier took it to the register. No idea how it was swiped but I would assume someone can print a card if the issuing bank and the numbers are all known.

Re:Do the CCs work?

[oPless]

Chip & PIN has been designed to offload risk to the card owner.

Besides, it's broken, and has been for a while. Now they're using contactless cards for sub £20 purchases - sigh.

Oh linky: http://hackaday.com/2010/02/12/chip-and-pin-broken-and-other-security-threats/

Re:Do the CCs work?

[tlhIngan]

You can erase and re-encode a different account number on an old mag stripe card. You may have noticed some stores have the cashier manually enter the last four digits of the credit card to prevent against this kind of fraud.

For a credit card, they actually enter in the CVV code - that code is NOT encoded on the stripe and only the issuing bank knows it.

Re:Do the CCs work?

[flimflammer]

Sadly no cashiers seem to scrutinize a credit card regardless if it's signed or not. Often times when I hand my credit card over, I will not be asked for ID, they won't check the signature, or any form of verification, unless I'm purchasing alcohol. Even then it's maybe a 20% chance I'll get carded and they're doing it purely for alcohol reasons.

Hell, my friend doesn't even sign the back of his cards for whatever reason, and he's never been questioned about it, despite a notice on the cards that say "CARD NOT VALID UNLESS SIGNED"

You're pretty much free in the clear to use any credit card you see fit in most shops with zero scrutiny. It's appalling.

Re:Do the CCs work?

[PTBarnum]

I used to do that. However, there are some cashiers (even rarer than the ones who ask for ID), who know and care that credit cards aren't valid unless signed and will not accept a card with "Ask for ID" on it.

Re:Do the CCs work?

[radarskiy]

Retailers are prohibited from asking for ID as part of their merchant agreement.

Re:Do the CCs work?

[radarskiy]

There are two CVV codes. The CVV2 code is only printed on the card; the CVV1 code is only encoded on the mag stripe. If you get the wrong code of the type of input, the transaction processor can identify a fraudulent transaction.

The cases where the cashier is manually entering the CVV2 code are on terminals where the mag reader is not talking directly to the transaction network but is filling out a form field. Some places just have a web app as their POS terminal.

Re:Do the CCs work?

[ottothecow]

You don't get asked for ID because the merchant agreement forbids the cashier from requiring an ID for a credit card transaction. An ID is not required to use a credit card and random merchants or customers don't get to change the agreement willy-nilly (not that it stops them from trying...just like all the shops that had $5 minimums on CCs before that became legal in 2010). In fact, a credit card without a signature is technically not a valid card and can be refused.

A merchant can ask for your ID, but they cannot require it for acceptance of the card (maybe it will scare someone off, but a smart criminal would just refuse). In the case where the card is not signed (or has See ID or some other housewife-myth written on it), the protocol is for the cashier to ask you to sign the card in front of them and compare the signature to a government ID. In this case, it is not quite clear, but it sounds like they *can* deny you for not presenting ID. So basically, the unsigned/See ID trick only works once--the first time someone actually follows the rules and calls you out on it, they will make you sign the card.

Check out pages 33 and 34 (the written numbers, not the PDF numbers) of this PDF for more info: http://usa.visa.com/download/merchants/card-acceptance-guidelines-for-visa-merchants.pdf. If you recall back to maybe the early 90s, there was a big ad campaign where celebrities (I think I remember a seinfeld one) would try to pay with a check and the cashier wouldn't take it since they forgot their ID...and then some random guy would walk in and pay with a CC without a question.

Re:Do the CCs work?

[Qzukk]

I actually never sign my cards, as a point of course... I put "Ask for ID" on the signature line... rarely do I get asked for ID.

And I'm sure the machine you swiped the card through yourself checked the signature very carefully.

Who is getting ripped off here?

[Presto Vivace]

I am sorry to say that I have a grudging admiration for any grifter who can separate a client from money in exchange for fake "likes."

Re:Who is getting ripped off here?

[simonbp]

Who's the more foolish? The fool, or the fool who fake-follows him a 1000 times for $15?

Re:Who is getting ripped off here?

[NoNonAlphaCharsHere]

I'm baffled that there's any value in real "likes". Other than marketing-department dick-waving, that is. Has anybody noticed the CW commercials for new shows this fall all end with "Go to Facebook and like (some show you've never seen and isn't out yet)". Seriously, does the fact that some random web surfer took the time and effort to click a button really have any real-world value?

Re:Who is getting ripped off here?

[Presto Vivace]

Getting viewers to go to the show's website and comment would be a better way. Or building an email list. What is happening is that marketers are being gamed into building Facebook's business rather than their own.

Re:Who is getting ripped off here?

[phantomfive]

It's possibly useful for SEO. Think of all the shady methods people used to try to improve their search engine ratings (and it can be worth a lot to be at the top of Google search results). Marketers used to go crazy trying to get a story voted up, even one time, on Digg. Possibly the price is increased because marketers are not using their own money to buy them.

Re:Who is getting ripped off here?

[jours]

They're useful on Facebook. If I have 1000 likes for my show and I post something new then almost all of those 1000 are going to see it in their newsfeed. If I send 1000 e-mails only maybe 15% of them will open it. And I paid to send the e-mail.

Re:Who is getting ripped off here?

[Presto Vivace]

Not really, just because someone has "liked" your page does not necessarily mean that they will see your feed.. Unless, of course, you pay extra to Facebook so that those who "liked" your page will actually see your content. The question always arises, whose business are you building, yours or Facebook's?

Supply and Demand

[Saint Gerbil]

I'd have thought that lots of people can offer credit card numbers since they have been around for a while.
Instagram likes are a new "product" and presumably available from fewer places hence more expensive.